PT-2019-5776 · Schedmd+1 · Slurm+1

Egbert Eich · Published 2019-12-11 · Updated 2024-06-15 · CVE-2019-19728

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SchedMD Slurm versions prior to 18.08.9 SchedMD Slurm versions 19.x prior to 19.05.5

Description The issue is related to the srun --uid command in the SLURM resource management system, which is associated with insecure privilege management. Exploitation of this issue allows a remote attacker to access confidential data, compromise its integrity, and cause a denial of service.

Recommendations For SchedMD Slurm versions prior to 18.08.9, update to version 18.08.9 or later. For SchedMD Slurm versions 19.x prior to 19.05.5, update to version 19.05.5 or later.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

BDU:2021-01916

CVE-2019-19728

DSA-4841-1

OPENSUSE-SU-2020:0085-1

OPENSUSE-SU-2020_0085-1

OPENSUSE-SU-2024:11389-1

SUSE-SU-2020:0110-1

SUSE-SU-2020:0420-1

SUSE-SU-2020:0434-1

SUSE-SU-2020:0443-1

SUSE-SU-2020:2607-1

SUSE-SU-2020_0420-1

SUSE-SU-2021:0773-1

Affected Products

Slurm

Suse

References · 93

• https://osv.dev/vulnerability/SUSE-SU-2020:0420-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-01898 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-19728 · Security Note
• https://lists.schedmd.com/pipermail/slurm-announce · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:0443-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-19728 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12693 · Security Note
• https://osv.dev/vulnerability/DSA-4841-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:0110-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:0773-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-01856 · Security Note
• https://osv.dev/vulnerability/CVE-2019-19728 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00038.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-01904 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2020:0085-1 · Vendor Advisory